Source URL: https://news.slashdot.org/story/25/09/27/1819239/did-microsoft-hide-key-data-flow-information-in-plain-sight?utm_source=rss1.0mainlinkanon&utm_medium=feed
Source: Slashdot
Title: Did Microsoft Hide Key Data Flow Information In Plain Sight?
Feedly Summary:
AI Summary and Description: Yes
Summary: The report reveals significant concerns regarding Microsoft’s management of policing data within its cloud infrastructure, particularly related to data sovereignty and the company’s lack of transparency about its international data flows. This is crucial for compliance and security professionals dealing with sensitive law enforcement data.
Detailed Description: The text highlights serious issues surrounding Microsoft’s handling of data for UK police under its Office 365 infrastructure. Here are the major points of significance:
– **International Data Flows**: Microsoft processes policing data in over 100 countries, which raises questions about the security and compliance of this data.
– **Lack of Transparency**: Microsoft has reportedly withheld important information from the Scottish Police Authority (SPA) and Police Scotland concerning its international data transfers, complicating compliance with data protection laws.
– **Data Protection Act Compliance**: The inability of the SPA and Police Scotland to ensure adherence to Part Three of the Data Protection Act 2018 (DPA18) due to the unavailability of Microsoft’s risk assessments poses a serious legal risk.
– **Sovereignty of Data**: Microsoft has admitted it cannot guarantee the sovereignty of policing data processed within its services, echoing earlier statements regarding European data.
– **Access by Microsoft**: An independent security consultant reported that Microsoft can access customer data from 105 different countries, employing 148 sub-processors, which could expose sensitive information to various jurisdictions.
– **Due Diligence Issues**: The fragmented distribution of information across non-indexed webpages creates barriers for security professionals attempting to perform due diligence on data protection measures.
This report underscores the critical need for transparency and robust compliance mechanisms when using cloud services for sensitive data, particularly in the context of law enforcement, raising important considerations for security and data protection professionals.